> How Chartbeat uses cookies, engaged time, and scroll metrics under GDPR and ePrivacy, with practical compliance steps for EU publishers. > > Canonical: https://www.flowconsent.com/en/services/analytics/chartbeat Analytics # Chartbeat Analytics Chartbeat is a real time content analytics platform for publishers that measures concurrent visitors, engaged time, scroll depth, traffic sources, and headline performance, with editorial dashboards used by newsrooms and publishing teams. [Block Chartbeat until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=analytics) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Analytics](https://www.flowconsent.com/en/services/analytics) - Consent Analytics - Prior consent Required - Documented cookies 5 - Third-party domains 5 - Servers United States (Chartbeat is headquartered in New York and operates infrastructure on Amazon Web Services in US regions). A small operations footprint in Europe handles support, but the analytics processing pipeline and storage of long term data run primarily in the United States. Overview ## What does Chartbeat do? ## **What Chartbeat is** Chartbeat is a real time content analytics platform built for publishers, newsrooms, and editorial teams. The signature feature is a live dashboard that shows the number of concurrent readers on each page, the engaged time spent on the article, where readers come from, how far they scroll, and how each headline performs. Editors use those signals to choose homepage placements, refresh underperforming headlines, and shape coverage. Behind the scenes, a small JavaScript snippet on each page sends periodic pings to Chartbeat servers, which aggregate the activity into dashboards, alerts, and historical reports for news leaders. ## **Cookies and identifiers used** Chartbeat sets persistent and session cookies that identify returning visitors and stitch sessions across pages, plus storage that holds short term state for engagement measurement. Typical artefacts include the \_chartbeat2 long term identifier, the \_chartbeat4 session cookie, and the \_cb\_svref referrer cookie. The platform also processes IP addresses, user agents, page URLs, scroll depth, focus events, and editorial metadata sent through the snippet. Even though the data is mostly behavioural, the combination of identifier and IP address makes it personal data under GDPR Article 4. ## **GDPR and ePrivacy obligations** Chartbeat is a non essential analytics service under EU regulator guidance from the CNIL, the AEPD, and the BfDI, so its cookies and pings require prior consent under ePrivacy Article 5(3). GDPR applies to the visitor data sent to Chartbeat, with the publisher acting as controller and Chartbeat as processor for the analytics service. Some regulators recognise narrow audience measurement exemptions for first-party, identifier free counters, but the default Chartbeat setup uses identifiers and cross page tracking and therefore falls outside that exemption. ## **Data transfers to the United States** Chartbeat is headquartered in New York and runs the analytics pipeline on Amazon Web Services in the United States. Visitor IPs, identifiers, and engagement events are therefore transferred to a third country. After Schrems II, controllers must complete a transfer impact assessment, rely on Standard Contractual Clauses, and, where applicable, the EU: US Data Privacy Framework certification. Supplementary measures may include IP truncation, sample reduction, and contractual additions, and the choices should be documented and reviewed. ## **Consent management and configuration** Load Chartbeat only after the visitor has accepted analytics cookies, gating the snippet through your consent management platform. Configure the platform to provide a refuse choice as accessible as the accept choice, store the proof of consent, and offer a link to change preferences. If you want to keep some signal even when consent is refused, consider switching to an aggregated, identifier free analytics tool, or use Chartbeat features that do not rely on persistent identifiers, with a documented balancing test for legitimate interest. ## **Practical compliance checklist** Add Chartbeat to the records of processing and the cookie policy with the categories of data, the retention, and the transfer mechanism. Sign the data processing addendum with Chartbeat and review the sub processor list. Run a DPIA, complete a transfer impact assessment, and document supplementary measures. Set retention values, test the site with consent denied to verify that no Chartbeat cookie or ping is sent before opt in, and review the configuration whenever Chartbeat features or sub processors change. Compliance ## Chartbeat and the GDPR Chartbeat is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Article 6(1)(a) GDPR consent for non essential analytics cookies and similar identifiers, in line with ePrivacy Article 5(3) and the CNIL, AEPD, and BfDI guidance. Aggregated, identifier free counters might rely on Article 6(1)(f) legitimate interest with a documented balancing test, but the standard Chartbeat configuration uses identifiers and therefore requires consent. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive 2002/58/EC, French Data Protection Act, German TDDDG, Spanish LSSI Article 22.2, UK PECR, EU: US Data Privacy Framework where applicable, EDPB guidelines on cookies and consent. ### Impact assessment (DPIA) A DPIA is recommended for publishers with significant EU readership because Chartbeat performs systematic monitoring of online behaviour, uses persistent identifiers, and transfers data to the United States. Document the categories of personal data, the cookies and storage used, the legal basis for analytics, the SCCs and Data Privacy Framework reliance, the retention applied to engagement data, and the residual risk after consent gating. Reference the CNIL, AEPD, and EDPB positions on third country transfers. ### Sample text for your banner > We use Chartbeat to measure how readers engage with our content in real time, including concurrent visitors, engaged time, and scroll depth. With your consent, Chartbeat sets cookies and transfers data to its infrastructure in the United States. You can accept, refuse, or change your choice at any time from the cookie settings link in the footer. Cookies and trackers ## What Chartbeat sets and contacts - Tracking method JavaScript snippet loaded on publisher pages that pings Chartbeat servers periodically to capture real time visitor counts, engaged time, scroll depth, viewport visibility, referrer, and content metadata. Persistent and session cookies and similar storage identify returning visitors and stitch sessions across pages and devices. - Server location United States (Chartbeat is headquartered in New York and operates infrastructure on Amazon Web Services in US regions). A small operations footprint in Europe handles support, but the analytics processing pipeline and storage of long term data run primarily in the United States. - Data transferred outside the EU Visitor IP addresses, page URLs, referrers, engagement metrics, and pseudonymous identifiers are transferred to Chartbeat infrastructure in the United States. Transfers rely on Standard Contractual Clauses and on the EU: US Data Privacy Framework where Chartbeat or its sub processors are certified, supported by a transfer impact assessment. ### Cookies set (5) | Name | Type | Duration | Purpose | | ------------ | ------------ | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | \_chartbeat2 | first\_party | 13 months | Long term identifier set by Chartbeat to recognise returning visitors and to attribute engaged time and scroll metrics to the same user across visits. | | \_chartbeat4 | first\_party | Session | Session cookie used by Chartbeat to group page views and engagement events that belong to the same visit. | | \_cb\_svref | first\_party | 30 minutes | Cookie used by Chartbeat to capture the referrer information that brought the visitor to the site for source attribution. | | \_cb | first\_party | 13 months | Cookie used by Chartbeat as a complementary identifier for engagement and audience metrics. | | \_cb\_ls | first\_party | 1 year | Cookie used by Chartbeat to keep a local state for engagement measurement and to support some real time dashboard features. | ### Third-party domains contacted (5) - `chartbeat.com` - `static.chartbeat.com` - `ping.chartbeat.net` - `api.chartbeat.com` - `mab.chartbeat.com` Questions ## Frequently asked questions about Chartbeat Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does Chartbeat set cookies on visitor devices? Yes. Chartbeat writes persistent and session cookies, including \_chartbeat2, \_chartbeat4, and \_cb\_svref, plus similar storage used to identify returning visitors and to measure engaged time and scroll depth. Because these identifiers are stored on the visitor device, ePrivacy Article 5(3) applies and consent is required before they are written or read. ### Is consent required for Chartbeat in the EU? In almost all configurations, yes. The CNIL, AEPD, and BfDI consider general purpose audience analytics that uses persistent identifiers and tracks readers across pages as non essential, so consent is required. The narrow audience measurement exemption only covers strictly first-party, identifier free counters, which is not the default Chartbeat setup. ### What is the legal basis for using Chartbeat? Article 6(1)(a) GDPR consent is the appropriate legal basis when Chartbeat is loaded with its standard configuration of persistent cookies and engagement tracking. Aggregated, identifier free counters could in theory rely on Article 6(1)(f) legitimate interest with a documented balancing test, but that requires custom configuration and additional safeguards. ### Are data transfers to the United States compliant? They can be, with the right safeguards. Chartbeat hosts on AWS in the United States, so transfers must rely on Standard Contractual Clauses and, where applicable, the EU: US Data Privacy Framework certification. Controllers should complete a transfer impact assessment, document supplementary measures such as IP truncation, and review the documentation if Chartbeat changes infrastructure or sub processors. ### Do I need a DPIA before deploying Chartbeat? A DPIA is recommended for publishers with significant EU readership. The combination of large scale behavioural monitoring, persistent identifiers, and US transfers matches several criteria from the EDPB DPIA guidelines. Document the data flows, the legal basis, the integrations, the retention, and the residual risk after mitigations such as consent gating. ### How do I implement consent gating with Chartbeat? Block the Chartbeat snippet through your consent management platform until the visitor has accepted analytics cookies. Make the refuse option as easy as the accept option, persist the proof of consent, and provide a link to change preferences. Ensure the snippet does not load and that no Chartbeat cookie or ping is sent before consent. ### What are the alternatives if consent is refused? If consent is refused, switch to a privacy first analytics setup, for example Matomo configured without cookies, an internal aggregated counter, or Chartbeat in a reduced mode if the vendor allows identifier free measurement. Editorial decisions can also rely on contextual signals and direct feedback rather than cross page reader profiles. ### How should the cookie policy describe Chartbeat? List Chartbeat as a US analytics processor, mention each cookie it sets along with the duration and purpose, and explain that engagement metrics and identifiers are transferred to the United States. Disclose the legal basis, the SCCs, the EU: US Data Privacy Framework where applicable, the retention values, and the contact details for exercising data subject rights. Same category ## More services: Analytics [See the whole category](https://www.flowconsent.com/en/services/analytics) ### [Hubalz](https://www.flowconsent.com/en/services/analytics/hubalz) [Hubalz is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Hubalz supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Hubalz enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/hubalz) [Analytics](https://www.flowconsent.com/en/services/analytics/hubalz) · ### [Sitecore Engagement Cloud](https://www.flowconsent.com/en/services/analytics/sitecore-engagement-cloud) [Sitecore Engagement Cloud is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Sitecore Engagement Cloud provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Sitecore Engagement Cloud ensures optimal performance at scale.](https://www.flowconsent.com/en/services/analytics/sitecore-engagement-cloud) [Analytics](https://www.flowconsent.com/en/services/analytics/sitecore-engagement-cloud) · ### [Logaholic](https://www.flowconsent.com/en/services/analytics/logaholic) [Logaholic is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Logaholic supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Logaholic enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/logaholic) [Analytics](https://www.flowconsent.com/en/services/analytics/logaholic) · ### [Metrilo](https://www.flowconsent.com/en/services/analytics/metrilo) [Metrilo is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Metrilo supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Metrilo enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/metrilo) [Analytics](https://www.flowconsent.com/en/services/analytics/metrilo) · ### [The Hotels Network](https://www.flowconsent.com/en/services/analytics/the-hotels-network) [The Hotels Network is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. The Hotels Network offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, The Hotels Network empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/the-hotels-network) [Analytics](https://www.flowconsent.com/en/services/analytics/the-hotels-network) · ### [Everflow](https://www.flowconsent.com/en/services/analytics/everflow) [Everflow is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Everflow offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Everflow empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/everflow) [Analytics](https://www.flowconsent.com/en/services/analytics/everflow) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)